Skip to main content
Announcements
Have questions about Qlik Connect? Join us live on April 10th, at 11 AM ET: SIGN UP NOW
Katie_Davis
Digital Support
Digital Support

Latest update as of Feb. 15, 2022. All current threats have been addressed. 

Further updates will be made as new information becomes available. 

Qlik has been diligently reviewing and testing our product suite since we’ve become aware of the Apache Log4j vulnerability mid-December.  We want to ensure Qlik users that your security is our upmost priority. We have addressed multiple vulnerabilities through a series of product patches for supported affected versions and we recommend you update to the most recent releases available, shown in the chart below.

Log4j versions before v2.16 presented the highest threat and all exposed Qlik products have provided patches with at least v2.16 and will all be updated to v2.17.1 or later under the regular release schedule as we are not vulnerable to the CVEs related to 2.17.0

We’d like to direct you to our FAQ document to review should you have any further questions, and we encourage you to comment with any additional questions.

The following products are not affected:

    • Qlik Sense Enterprise, all supported versions
    • Qlik Sense Enterprise SaaS
    • QlikView, all supported versions
    • Nprinting, all supported versions
    • Qlik Alerting, all supported versions
    • Qlik Web Connectors, all supported versions
    • Qlik RepliWeb and ARC, all supported versions
    • AIS, including ARC, all supported version
    • Nodegraph
    • AutoML
    • Qlik Catalog supported versions before May 2021 are not affected
    • Blendr
    • Qlik Data Transfer
    • Salesforce and SAP Connectors are not affected
    • Qlik Forts
    • ODBC Connector Package
    • REST Connectors
    • Qlik Sense Business

 

The following products are under review:

    • Attunity Visibility

The following products are affected. Qlik has provided patches linked here; customers are advised to install the patches at their earliest convenience.  

Downloads can be accessed by visiting our new Downloads page  on Qlik Community when signed in with your Qlik ID , then selecting the product then the latest release.

Affected Product Version

CVE-2021-44228

CVE-2021-45046

CVE-2021-45105

CVE-2021-44832

Recommended Action

Log4J Version included in patch

Compose 2021.8

Vulnerable, solved by patch

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

Install 2021.8 SR01

Up to 2.16.0

Compose 2021.5

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 2021.5 SR01

Up to 2.16.0

Compose 2021.2

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 2021.2 SR01

Up to 2.16.0

C4DW 7.0

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 7.0 2021 SR04

Up to 2.16.0

C4DW 6.6.1

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 6.6.1 SR03

Up to 2.16.0

C4DW 6.6

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 6.6.0 SR06

Up to 2.16.0

 

C4DL 6.6

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 6.6.0 SR09

Up to 2.16.0

 

Replicate 2021.11

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install version published 22 Dec 2021

Up to 2.16.0

 

Replicate 2021.5

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 2021.5 SR 05

Up to 2.16.0

 

Replicate 7.0

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 7.0.0 SR05 

Up to 2.16.0

 

Replicate 6.6

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 6.6.0 SR06

Up to 2.16.0

 

QEM 2021.11

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install version published 22 Dec 2021

Up to 2.16.0

 

QEM 2021.5

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 2021.5 SR05

Up to 2.16.0

 

QEM 7.0

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 7.0.0 SR05

Up to 2.16.0

 

QEM 6.6

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not vulnerable

 

Not vulnerable

 

Install 6.6.0 SR03

Up to 2.16.0

 

Catalog 4.12.0, 4.12.1

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not Vulnerable, JDBC Appender not configured

Install 4.12.2

Up to 2.17.0

 

Catalog 4.11.0, 4.11.1

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not Vulnerable, JDBC Appender not configured

Install 4.11.2

Up to 2.17.0

 

Catalog 4.10.0, 4.10.1, 4.10.2

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Vulnerable, solved by patch

 

Not Vulnerable, JDBC Appender not configured

Install 4.10.3

Up to 2.17.0

 

GeoAnalytics Server - 4.32.3 and 4.23.4

Vulnerable, solved by patch Vulnerable, solved by patch Vulnerable, solved by patch Vulnerable, solved by patch

Install 4.32.5

Up to 2.17.1

GeoAnalytics Server - 4.27.3 - 4.19.1

Vulnerable, solved by patch Vulnerable, solved by patch Vulnerable, solved by patch Vulnerable, solved by patch

Install 4.27.4 – 4.19.2

Up to 2.17.1

GeoAnalytics Plus - 5.31.1 and 5.31.2

Vulnerable, solved by patch

Vulnerable, solved by patch

Vulnerable, solved by patch

Vulnerable, solved by patch

Install 5.31.3

Up to 2.17.1

GeoAnalytics Plus - 5.30.1-5.29.4

Vulnerable, solved by patch

Vulnerable, solved by patch

Vulnerable, solved by patch

Vulnerable, solved by patch

Install 5.30.2 – 5.29.5

Up to 2.17.1

GeoAnalytics Plus - 5.28.2-5.27.5

Vulnerable, solved by patch

Vulnerable, solved by patch

Vulnerable, solved by patch

Vulnerable, solved by patch

Install 5.28.3 – 5.27.6

Up to 2.17.1

GeoAnalytics Plus - 5.26.5

Vulnerable, solved by patch

Vulnerable, solved by patch

Vulnerable, solved by patch

Vulnerable, solved by patch

Install 5.26.6

Up to 2.17.1

 

Please keep in mind that Qlik's on-premise (or client-managed) data integration products are intended to only be accessed on an internal network; therefore any potential impacts of CVE-2021-44228 should be mitigated by your internal network and access controls.

For information on supported versions, please visit the Product Support Lifecycle

 

Please subscribe to our Support Updates blog for continued updates. 

Thank you for choosing Qlik, 

Qlik Global Support

 

 

Change Log:

  • Post Created Dec. 11, 2021
  • Dec. 11, 2021 1:30pm EST: Updated article to specify which products were confirmed as not affected or still under evaluation
  • Dec. 12, 2021 2:00pm EST: Updated to state that QCS was not affected; added additional products as under evaluation
  • Dec. 13, 2021 12:15pm EST: Updated to specify which versions applied to not affected products; added changelog.

  • Dec. 13, 2021 3:15pm EST: Updated to specify which versions are affected with steps to mitigate and which products we are still evaluating.

  • Dec. 13, 2021 5:10pm EST: Added GeoAnalytics Plus mitigation, and expanded "not affected" section to further products. 5:55pm EST added AIS to not affected list.
  • Dec. 14, 2021 2:10pm EST: Added Qlik Catalog, Blendr, and Qlik Data Transfer to reviewed list. Added mitigation steps for Qlik Catalog.

  • Dec. 14, 2021 2:45pm EST: Added JDBC, Salesforce and SAP Connectors to the not affected list.
  • Dec. 15, 2021 3:05pm EST: Added Patch schedule, and the following items to NOT affected: Qlik Forts, ODBC Connector, REST connectors, and Qlik Sense Business. 
  • Dec. 16, 2021 1:15pm EST: Updated Catalog version details in Patch schedule. 

  • Dec. 17, 2021: 3:25pm EST: Mitigation steps for Compose, Replicate, and QEM were updated
  • Dec. 20, 2021 9:00am EST: Updated link to Catalog patches.
  • Dec. 20, 2021 1:15pm EST: Updated top post for status of CVE-2021-45105 and language around Catalog to be 'Hotfix' with full version patches in early Jan. 2022 in published.

  • Dec. 21, 2021 3:45pm EST: Updated Catalog to be 'Service Releases' with full version 2.17 published to downloads page. 

  • Dec. 22, 2021 8:30am EST: Compose 2021.8 released on Qlik Download pages
  • Dec. 28, 2021 10:40am EST: Compose 2021.2 -- SR1, Replicate 2021.5 -- SR5, and QEM 2021.5 -- SR5 released on Qlik Download pages and marked as published. 12:00pm combined mitigation links with Patch release schedule chart.
  • Dec. 30, 2021 11:00am EST: Patch Release published for C4DW 7.0 - 2021 -- SR4
  • January 6, 2021 9:30am EST: Updated expected time for GeoAnalytics patches to "Early January".
  • January 11, 2022 7:00am EST: Updated to reflect all GeoAnalytics patches as published.
  • January 14, 2022 2:00pm EST: Marked the following patches as published: C4DW 6.6.0 -- SR06,C4DW 6.6.1 -- SR03, C4DL 6.6.0 -- SR09, Replicate 6.6.0 -- SR06, Replicate 7.0.0 -- SR05, QEM 6.6.0 -- SR03, QEM 7.0.0 -- SR05
  • January 20, 2022 3:15pm EST: Clarified that there are two patches for GeoAnalytics November 2021. Patch 2 updates log4j to 2.17.0
  • February 15, 2022 4:00pm EST: Updated chart to breakout vulnerabilities per product, reflect the latest patch versions to upgrade to, changed post title, and clarified intro statement.

217 Comments
gn1
Contributor
Contributor

Is there any impact on Qlikview in relation to CVE-2021-4104 (Log4j 1.x )

1,197 Views
PatrickQ
Contributor III
Contributor III

@gn1 , I originally replied that supported versions of QlikView are not affected, which is true of CVE-2021-44228; let me get back to you regarding the CVE you mentioned. I misread your post, I apologize.

1,141 Views
JoJo
Contributor
Contributor

Just to confirm, Repliweb MFT (a.k.a. Attunity MFT) is not impacted by the Log4j vulnerability, correct?

1,061 Views
IvanSmith
Contributor
Contributor

Reposting from the Qlik replicate thread in case this helps someone here:

Hello,

It may be prudent to update the mitigation steps for Qlik as Apache and CVE-2021-45046 mention setting the formatMsgNoLookups=true flag to mitigate the threat is no longer valid:

https://logging.apache.org/log4j/2.x/security.html

 

The notable line is:


"Other insufficient mitigation measures are: setting system property log4j2.formatMsgNoLookups or environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true for releases >= 2.10"

 

I have applied the command:

find / -name "log4j-core-*" -exec sudo zip -q -d "{}" org/apache/logging/log4j/core/lookup/JndiLookup.class  \;


With success for both Qlik Enterprise Manager (current version 2021.5.0.313) and Qlik Replicate (version 2021.5.0.863, without endpoint server enabled). Apache has handlers for exclusion of the JNDILookup.class which mitigate any exceptions caused by this operation.

If anyone from Qlik could validate that the current application does not leverage the JNDILookup.class in any other operation, it would be appreciated.

No replicate issues or abnormal behaviour noted to date in any environment. I hope this helps someone else.

Regards,

Ivan

959 Views
PatrickQ
Contributor III
Contributor III

Hello everyone, we have just updated our mitigation steps for Replicate, Compose, and QEM to address the new vulnerability, CVE-2021-45046,  that was reported this morning. As a reminder, Qlik is providing these mitigation steps as a temporary measure. Patches will be provided and linked on the blog post; customers are advised to install the patches as soon as they are available. 

891 Views
john_wang
Support
Support

Hello @IvanSmith , 

thank you so much for your feedback. I did sanity test on Replicate 2021.5 and we got same result. Hope my detailed steps and result helps.

https://community.qlik.com/t5/Support-Updates-Blog/Vulnerability-Testing-Apache-Log4j-reference-CVE-...

Regards,

John.

794 Views
AmitH
Contributor
Contributor

Thanks for the updated mitigation steps , we implemented the steps, only thing I did additional is while copying the file ( from downloads) I renamed it to original name. For example if downloaded file name is log4j-core-nolookup-2.11.1.jar then after placing the file in required directory I renamed it to  log4j-core-2.11.1.jar

I am not sure if its required or not

1,434 Views
john_wang
Support
Support

Hello @AmitH ,

You are right. the necessary steps are:

1. download the zip file;

2. unzip the compress file;

3. copy a given version .jar from the uncompressed folder to the original location and rename it to the original name.

Hope this helps.

Regards,

John.

1,378 Views
AlexOmetis
Partner Ambassador
Partner Ambassador

I see on the download site 3 patches for Qlik Catalog with accompanying release notes and specific instructions for log4j2 (e.g. QlikCatalog_log4j2 (da3hntz84uekx.cloudfront.net)) so I think the table needs updating to say these are already available rather than coming in January. 

1,218 Views
goncalves_ep
Contributor II
Contributor II

Hi @Katie_Davis ,

Please update information on your post based on latest updates by apache saying version 2.16 is also affected (vulnerability range changed and also version 2.17 is needed).

https://logging.apache.org/log4j/2.x/security.html 

Thanks & Regards

Eduardo

992 Views